├── .gitattributes ├── Cmdlets ├── Copy-ForensicFilePortable.ps1 ├── Get-ForensicAlternateDataStreamPortable.ps1 ├── Get-ForensicAttrDefPortable.ps1 ├── Get-ForensicAttrDefPortableTest.ps1 ├── Get-ForensicChildItemPortable.ps1 ├── Get-ForensicFileRecordIndexPortable.ps1 ├── Get-ForensicFileRecordPortable.ps1 ├── Get-ForensicFileSlackPortable.ps1 ├── Get-ForensicMftSlackPortable.ps1 ├── Get-ForensicNetworkListPortable.ps1 ├── Get-ForensicRunKeyPortable.ps1 ├── Get-ForensicScheduledJobPortable.ps1 ├── Get-ForensicSidPortable.ps1 ├── Get-ForensicTimezonePortable.ps1 ├── Get-ForensicUsnJrnlInformationPortable.ps1 ├── Get-ForensicUsnJrnlPortable.ps1 ├── Get-ForensicVolumeInformationPortable.ps1 ├── Get-ForensicVolumeNamePortable.ps1 ├── Install-PowerForensicsDll.ps1 ├── Invoke-CommandAST.ps1 ├── MethodHelper.ps1 └── PowerObject.ps1 ├── LICENSE ├── PowerForensicsPortable.psd1 └── PowerForensicsPortable.psm1 /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/.gitattributes -------------------------------------------------------------------------------- /Cmdlets/Copy-ForensicFilePortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Copy-ForensicFilePortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicAlternateDataStreamPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicAlternateDataStreamPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicAttrDefPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicAttrDefPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicAttrDefPortableTest.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicAttrDefPortableTest.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicChildItemPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicChildItemPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicFileRecordIndexPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicFileRecordIndexPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicFileRecordPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicFileRecordPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicFileSlackPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicFileSlackPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicMftSlackPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicMftSlackPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicNetworkListPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicNetworkListPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicRunKeyPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicRunKeyPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicScheduledJobPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicScheduledJobPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicSidPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicSidPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicTimezonePortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicTimezonePortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicUsnJrnlInformationPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicUsnJrnlInformationPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicUsnJrnlPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicUsnJrnlPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicVolumeInformationPortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicVolumeInformationPortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Get-ForensicVolumeNamePortable.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Get-ForensicVolumeNamePortable.ps1 -------------------------------------------------------------------------------- /Cmdlets/Install-PowerForensicsDll.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Install-PowerForensicsDll.ps1 -------------------------------------------------------------------------------- /Cmdlets/Invoke-CommandAST.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/Invoke-CommandAST.ps1 -------------------------------------------------------------------------------- /Cmdlets/MethodHelper.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/MethodHelper.ps1 -------------------------------------------------------------------------------- /Cmdlets/PowerObject.ps1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/Cmdlets/PowerObject.ps1 -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/LICENSE -------------------------------------------------------------------------------- /PowerForensicsPortable.psd1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/PowerForensicsPortable.psd1 -------------------------------------------------------------------------------- /PowerForensicsPortable.psm1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Invoke-IR/PowerForensicsPortable/HEAD/PowerForensicsPortable.psm1 --------------------------------------------------------------------------------